Mechanical engineer student going on a whim as to why it’s not blowing up. Either, it’s using a half-duplex protocol and there’s no information going from the Arduino to the Pi. I’m not sure that’s possible with SPI. More probably, there’s 5v going to the Pi but it’s holding up. If you have a clean signal, 3.3v or 5v high and lows will be recognized properly by either standard though there’s an obvious risk of overdriving the Pi. I’ve personally unknowingly plugged a 3.3v SPI GPS module to an Arduino (3.3v power but 5v logic from the Arduino) and it held up and actually worked.